Associate Compliance Privacy Director

Exelixis•Alameda, CA

1d•Onsite

About The Position

The Associate Compliance Privacy Director supports and advances Exelixis’ privacy compliance program as a privacy subject matter expert and point of contact. The role partners with cross-functional teams to support enterprise-wide compliance with U.S. and global privacy and data security requirements, including GDPR, clinical trial regulations, and HIPAA obligations for the employee group health plan. It supports policy and SOP development, training, assessments, audits, monitoring, and coordination with Legal Affairs to translate evolving requirements into practical, scalable solutions and promote privacy and data security by design. The position provides privacy guidance across products, teams, research, and business initiatives; supports incident response, information governance, data security, investigations, and regulatory compliance; and manages privacy operations, data subject requests, impact assessments, and cross-border transfer requirements. It also partners with clinical operations, HR, benefits administrators, IT, Legal Affairs, and other stakeholders to operationalize data protection requirements, including privacy controls for AI, biometrics, emerging technologies, and website tracking and marketing technologies. The role has no supervisory responsibilities and requires up to 20% travel. It is based in Alameda, California. The stated base salary range is $219,000–$278,000.

Requirements

Bachelor’s degree in a related discipline and 11 years of relevant experience, or an equivalent combination of education and years of experience.
At least 11 years of professional experience, including at least 9 years in privacy or data protection in the life sciences, biotech, pharma, or medical device industry.
Experience focused on privacy program operations and governance, risk, and compliance activities.
At least 2 years of project management experience in a matrixed organization.
Experience advising on privacy matters involving health information processing.
Familiarity with patient consent management, call center operations, and digital outreach.
Experience working across a matrixed corporate environment.
Excellent interpersonal communication, collaboration, project management, and stakeholder management skills, with the ability to influence and collaborate at all organizational levels.
Ability to develop and deliver clear, concise presentations.
Strategic thinking and a proactive, risk-based approach.
Sound ethical judgment and consistent application of data protection principles.
Ability to devise creative business solutions for complex problems and implement organizational or team objectives.
Ability to manage ambiguity, multiple tasks, and changing priorities.
Highly organized, detail-oriented, and analytically rigorous, with the ability to multitask and prioritize.
Self-starter and quick learner.
Strong computer skills, including Microsoft Office Suite, document comparison programs, and the Internet.

Nice To Haves

CIPP/US, CIPP/E, CIPM, or similar certification.
Experience with AI and data governance.
Experience with HIPAA compliance in an employee benefits context.
Experience with privacy or knowledge management platforms and tools such as OneTrust, SNOW, or Confluence.
Experience with privacy matters in the digital and advertising technology ecosystem in the biopharmaceutical industry.
Strong understanding of global privacy frameworks and regulatory trends.
Proven ability to operationalize legal requirements into practical business solutions.
Familiarity with privacy considerations in vendor management, data transfers, and research protocols.
Demonstrated success implementing privacy compliance measures in a matrixed organization.

Responsibilities

Provide strategic and operational privacy support across the company and serve as the designated Compliance representative on the Information Governance Council and privacy control for relevant business processes.
Support incident response and management, information and data governance, and data security.
Develop an understanding of how data is used across products, teams, and research; document and implement privacy requirements for new products and initiatives.
Develop, document, and maintain privacy operations processes and procedures.
Assist with developing and maintaining privacy training and awareness programs for functions, new hires, and key stakeholders.
In collaboration with and at the direction of Legal Affairs, conduct internal investigations of privacy matters and support corrective actions.
Monitor and assess the impact of evolving U.S. federal and state privacy and data security laws, regulatory guidance, and enforcement trends on business operations and the privacy compliance program.
Report privacy compliance program performance indicators and metrics to senior leadership, supporting visibility, risk alignment, and continuous improvement.
Partner with global clinical trial operations to implement data protection requirements, including data transfer mechanisms, personal data notices, consent language, and data processing controls.
Provide guidance on HIPAA requirements for the company’s group health plan in collaboration with Legal Affairs, HR, and benefits administrators.
Conduct and manage privacy and data impact assessments as needed.
Support cross-border data transfer compliance, including transfer impact assessments and requirements under SCCs, the UK IDTA, and other mechanisms.
Manage data subject rights requests, coordinate reviews and responses across functions, and maintain compliance documentation.
Collaborate with Legal Affairs and IT on incident response and breach notification processes.
Align with Legal Affairs on preferred privacy-related and data security-related contract terms and provisions.
Partner with IT to operationalize data protection requirements in business processes, policies, and administrative and technical controls.
Analyze privacy impacts and recommend controls for initiatives involving AI, biometrics, and emerging technologies.
Manage data processing activities and respond to data subject and regulator inquiries.
Apply Privacy by Design principles to work products, processes, and decision-making throughout the lifecycle of initiatives.
Define, scope, and execute technical frameworks for website tracking privacy, aligning marketing technologies with global privacy regulations through consent management architecture, tag governance, and compliance auditing.
Build collaborative relationships with stakeholders to align on business initiative and project vision, priorities, and outcomes.
Participate in working groups, governance committees, and cross-functional initiatives with privacy or data security impacts.
Perform other duties as assigned and comply with all policies and standards.